Open Cairn control panels let outsiders send tasks to pentesting agents

NorForge tested exposed Cairn orchestration panels and describes unauthorized task creation against seventeen accessible environments. The attack surface was not the language model’s answer in isolation. A party who could reach the panel could submit work to an agent already equipped for security testing, redirecting that delegated authority toward credential access, host modifications or malware staging. The study reports some executions of a Poseidon worker-health payload and attempts to add SSH authorized keys. That does not show every panel was compromised at host level.

This event is distinct from NorForge’s earlier observation that some Cairn dashboards exposed campaign material. Here the tested direction is outsider-to-agent task injection, not simply observing someone else’s project or inferring its victims. It also differs from ReliaQuest’s individually investigated server intrusion. The identity of several panel operators remained unresolved, so the results should not be combined into one criminal campaign without shared actor or infrastructure evidence.